Oooof indeed, this is very credible. And the reason some services include boilerplate on their verification number texts that "we will not call and ask you for this number".
Please imagine it's there regardless.
Please imagine it's there regardless.
Consider - if your bank *calls you* at your number on record, they gain no new information, no extra assurance you are you, from texting you at that same number and having you read what they texted.
Somebody who knows more about telephony and infosec can verify this possibly, but I believe it's *easier* for someone to intercept a text to your number than it is for them to intercept the calls? And if a stranger has your phone or has just co-opted your number, both are hosed.
I absolutely understand why OP, in the moment, didn't question anything until asked for his actual account PIN (and I'm glad that was a red flag), but put "your bank will never ask you to read a thing they texted you" up there with "Microsoft will never call you about a virus."
